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(Rev.lO-QMSW). 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : - j ROUTINE 
To: Tampa 

From: Tampa 


Date:. 09/21/2000 


ItjQI 


Contact: 
Approved By:| 
•Drafted By: 


SAl 


.Case ID #:, 288A4TP-NEW 
Title: 


UNSUB (SL 
WALT DISNEY WORLD - VICTIM; 
SION' - INFO SYSTEM; 

P 


Synopsis: Recommendation to open and as sign case based .upon 

or>Vir>r>ir» interview with Walt Disney World 


Details: P:0. OBox 10000, Lake Buena Vista, 

Florida, 32830, telephoned and reported that a computer system: 
.which contains patron credit card and ^personal information -has 
been accessed ‘by an Unknown and. unauthorized person or persons . 


r 


stated, that .the .intrusion .was discovered bv a 


stated that[ 
intrusion . 


will ‘furnish technical details of the 


stated that the victim server (computer) has 
been disc onnected form , the network and has hot .been modified . 

stated hhat Disney IS personnel are awaiting 
instructions from the FBI. 


above. 


♦♦ 


.Recommend case be opened and assigned .as captioned 
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Receipt Given □ Yes □ No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
□ Yes ONo 

Title: 
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FD-340 (Rev. $-7-97) 


Universal Case File Number 1^ 4£ 

Field Office Acquiring Evidence ~"t~?*c 7 viPAr 


/4 



Serial # of Originating Document. 
Date R eceived //Z^r /ks*>g_ 


From 


J)f Contributor) 


fk/Z <^gyt 
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(Address of Contributor) 
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To Be Returned O Yes O No 
Receipt Given □ Yes □ No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 

Federal Rules of Criminal Procedure — 

K^Yes ONo 
Title: * 




Reference: 


(Communication Enclosing Material) 


Description: □ Original notes re interview of 
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FD-192 

Title and Character o c ” 

WALT DISNEY WORLD 

Date Property Acquire 
09/22/2000 










• /A// 


| Acquired: 
.2 WORLD 


09/26/00 

13:01:33 


ICMIPR01 
Page 1 


Anticipated Disposition:, arrm-irpri rv 

Description of Property: 

IB JL 

MAXELL "CD-R 650MB" COMPUTER COMPACT DISK 
Barcode: E01881337 Location: ECR1 



b6 

b7C - 

Date Entered 


r*~>n 7\ rmnt 


09/26/2000 


Case Number: 288A-TP-51940 

Owning Office:- TAMPA 
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Case ID 


Accepted B 
Reaso 


Accepted By 
Reason 

Accepted By 
Reason 


Accepted B 
Reaso 



Accepted By: 
Reason : 


Chain of Custody FD-192 


-51940 


Date Time 
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Accepted By: 
Reason: 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 
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FD-192 

Page 1 

1 i 


Title and Character of Case: ! 


[ 

WALT DISNEY WORLD 




Date Property Acquired: Source-rrom-wnxcn-yropercv' Acquired : 


09/23/2000 


Anticipated Disposition: Accruired Bv: 


Description of Property: 
XB 2 


Case Agent: 
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b7C 


Date Entered 


MAXELL "CD-R 650MB", COMPUTER COMPACT DISK 

Barcode: E01881338 Location: ECR1 / 09/26/2000 


Case Number: 288A-TP-51940 

Ovming Office : TAMPA 
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Title and Character of Case: 


WALT DISNEY WORLD 


Date Property Acquired: Source 


Igb'M •//>■ 


j Acguired! 


09/22/2000 


Anticipated Disposition: 


Description of Property: 
IB 3 




Date Entered 


3 1/2" FLOPPY DISK, 3M BRAND WITH "SONY" LABEL 
Barcode: E01881339 Location: ECR1 hS£3 


09/26/2000 


Case Number: 288A-TP-51940 

Owning Office: TAMPA 


3 - /V 7 - 5V? V0- //6 
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Accepted By 
Reason 
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Date Time 
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Reason : 
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Reason : 
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Reason : 
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Reason : 
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Reason : 
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Reason : 


Accepted By: 
Reason : 
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Case ID . 


Accepted By 
Reason^ 

Accepted By: 
Reason : 

Accepted By: 
Reason: 

Accepted By: 
Reason: 

Accepted By: 
Reason: 

Accepted By: 
Reason: 


Accepted By: 
Reason: 


Accepted By: 
Reason: 

Accepted By: 
Reason : 


Accepted By: 
Reason: 


Accepted By: 
Reason : 


Accepted By: 
Reason: 


Accepted By: 
Reason: 


Accepted By: 
Reason: 


Accepted By: 
Reason: 


Accepted By: 
Reason: 


sIP-51940 



Date Time 


4-n** tJtc-jvx. 


r-U'rt //V 


(f'f 
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Accepted By: 
Reason: 


Accepted By: 
Reason: 
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« Chain of Custody FD-192 
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Reason: 
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Reason: 
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13:01:33 

FD-192 


Page T 


Title and Character of Case: 


WALT DISNEY WORLD 


Date Property Acquired: 
09/22/2000 


fion re p. from whi,ch Property Acquired: 

'WALT DISNEY WORLD 


b6 

b7C 


■Anticipated 'Disposition : Acquired Bv: Case Agent : 

Description of Property: Date Entered’ 

IB 1 

MAXELL "CD-R 650MB" COMPUTER COMPACT DISK 

Barcode: E01881337 Location: ECR1 09/26/2000 


! 

i 

4 

* 

* Case Number: 288A-TP-51940 

i Owning Office: TAMPA 







ALL INFORMATION €X3NTAINID 
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09/26/00 
13 : 01 : 54 


Title and Character of Case: 
WALT DISNEY WORLD 


FD-192 


ICMIPR01 
Page 1 


Date Property Acquired: Source from which Property Acquired: 

INCIDENT RESPONSE SPECIALIST 

09/23/2000 


b6 

b7C 


Anticipated Disposition.: Acquired Bv: 


Case Agent: 


Description of Property: 

IB 2 

MAXELL "CD-R 650MB", COMPUTER COMPACT DISK 
Barcode : E01881338 Location: ECR1 


Date Entered 


09/26/2000 


I 
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FD-192 


ICMIPR01 
Page X ■ 
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Title and Character of Case: 


WALT DISNEY WORLD 


Date Property Acquired: 
09/22/2000 


snnvrp from w hich Property Acquired: 


b6 

b7C 


Anticipated Disposition: Acquired Bv: 

Description of Property: 

IB 3 

3 1/2" FLOPPY DISK, 3M BRAND WITH "SONY" LABEL 
Barcode: E01881339 Location: ECR1 


Oaao Snant- • 


Date Entered 


09/26/2000 




Case Number: 288A-TP-51940 

Owning Office: TAMPA 
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(Rev. 10-0M999) 




FEDERAL BUREAU OF INVESTIGATION 


i 


.Precedence: IMMEDIATE 

To:- Tampa. 

.'From: Tapoa- 

Contact: 

Approved By 

Drafted By: 

Case ID #: 288A-TP-51940-^ 
66F-TP-44851 


Title: UNSUB (S); 

WALT DISNEY WORLD - VICTIM; 
INTRUSION - INFO SYSTEM; 
00:tP 


Date: 09/27/2000 

Attn: CART Supervisor 



b6 

b7C 

b7E 


Synopsis: Request for C ART examinat ion regarding captioned case 

per conversation with SA 1 


b7E 



mo -a- 






[ALL IMfORM&TIGM CONrTilLINlD 
HEREIN IS UNCLASSIFIED' 

DATE □S-lS-2014 BY F46M82K40 NS ICG 




'U.S. Department of justice 


Federal Bureau of Investigation 


i la Reply, Please Refer to 
FileKo. 


*500 East Zack ’Street 


October 12, .2000 


b7C 

b7E 


Re: Internet connection logs 


Dear 


You are respectfully notified to preserve all records, 
logs , . ' anH nhher-^eividgnce £or_ the Internet 

•connection! , (for 

the ;period ^51" ftnrougn 


■documentation or other 


YOU: 


are to preserve an records, Jtogs, 
evidence as noted .above pursuant to Title 18 United ’States -.Code 
Section' 2703 (f) for an, initial period of ninety (90) days. 


YOu are further requested fnot to disclose the existence 
of or compliance with this notification. -’Any such 'disclosure 
could seriously impair * an on-going investigation into violations 
of United States Federal Criminal Law. 






!|ll iimmtmTim ammmm 

HEEEIH IS UHC LASSIF IEC 

f - 13-2014 3Y F4SY82K40 MS ICG 


(Rev, 0$-2$-2000) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : 
To: 


PRIORITY 


Date: 10/13/2000 


Attn: ALAT 



Title: UNSUB (S); 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION - INFO SYSTEM; 

00:TP 


Synopsis: Set lead fox 

1 at* t*ha 

* 

k 

to serve observation of 



L 

i 


Enclosure (s) : Preservation of evidence letter pursuant to Title 

18 U.S.C. Section 2703(f). 


Details: Per 

requests ALAT 
evidence letter to| 

nf rprnr^ [ 


tel cal, with SSA 


Tampa 


1 serve /deliver r.ne enclosed preservation of 


or other custodian 


The request is specifically to preserve user connection 
records for the Internet account or. accounts that, utilized the 

Int-ar-nat* nr-nt-nml a^rpgg 


through [ 


=T ’ the period 


ascertain the 
rucure cdurt orders or 


It is further requested that 
likelihood of compliance with possible 
subpoenas and provide Tampa a point of contact to whom future 
correspondence will addressed. 


b6 

b7C 

b7E 


b6 

b7C 

b7E 







To: 
Re : 


28SA-TP 


3 


From:- Tampa 
940 , 10 / 13/2000 


LEAD(s) : 

S et Lead 1: 

. . ( b7E 

Serve preservation of evidence letter and request 
subscriber information per details section of EC. 

♦♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: 


ROUTINE 


Date: 10/18/2000 


To: Counterterrorism 


From: 


contact 


Attn: 


Approved By: 
Drafted By: 


Case ID #: 288-TP-C42877 




Title: NIPCIP Investigative Accomplishments 

Synnnsis: All NIPCIP Investigative accomplishments to date for 

SA per Counterterrorism EC dated 8/21/2000. 

Details: SA | ~ captured investigative accomplishments 

for the period January 1999 to present per Counterterrorism EC 
dated 08/21/2000. 


files: 


The statistics were recorded from the following 288 case 


288A-TP-48550 

288A-TP- 50824 

288A-TP-51201 

288A-TP-51940- 

288A-TP-50809 

288A-TP-49236 

288A-TP-49698 

288A-TP-50999 

288A-TP-49214 

288A-TP-49192 

288A-TP-51037 


plus infonriant and cooperating witness files. 


Should Cl' 
please contact SA 




statistics, 





,tP- 5H4© -Jl 



w 

To: Counterterrorism From: Tampa 

Re: 288-TP-C42877, 10/18/2000 


Accomplishment Information: 

Number: 6 

Type: NIPCIP VICTIM CONTACTED/ INTERVIEWED 

ITU: NIPCIP \ 

Claimed Byi ' 1 

SSN: 

Name: 


Number: 1 

Type: NIPCIP SUBJECT TOOL/ EXPLOIT/MALICIOUS CODE IDENTIFIED 

ITU: NIPCIP 

Claimed By: 

SSN: 

, Name : 


Number: 2 

Type: NIPCIP FOREIGN SOURCE IP ADDRESS IDENTIFIED 

ITU: NIPCIP 

Claimed By* 1 

SSN: 

, Name ; 


Number : 3 

Type: NIPCIP SEARCH WARRANT OBTAINED 

ITU: CART 

ITU: NIPCIP 

Claimed By : 


SSN: 

Mamp ■ 





Number : 2 

Type: NIPCIP SEARCH WARRANT EXECUTED 

ITU: CART 

ITU: NIPCIP 


Claimed By:. 
SSN: 
Many* ■ 


Number: 2 

Type: NIPCIP 2703(f) ORDER SERVED 

ITU: NIPCIP 

Claimed By? . 

SSN: 

Name : | 


b 6 

b7C 

b7E 
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» * 




To: 

Re: 




Counterterrorism From: , Tampa 
288-TP-C42877 , 10/18/2000 


Squad: 6 

Number : 1 

Type: NIPCIP 2703(d) ORDER SERVED 

ITU; NIPCIP \ 

Claimed By,: i 

SSN :. 

, Name ; 


Number : 1 

Type: NIPCIP 2703(d) ORDER OBTAINED 

ITU: NIPCIP 


Claimed By 
SSN: 
Name: 


Number : 9 

Type: NIPCIP CONSENSUAL MONITORING CONDUCTED 

ITU: CONSENSUAL MONITOR 

ITU: NIPCIP 


Claimed By 
SSN: 
Name: 


Number a 

Type: 

ITU: ' iMJLPCJLF 

Claimed Byj 
SSN: 
Name; 


b3 

b6 

b7C 
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Number : 6 

Type: NIPCIP SUBJECT IDENTIFIED 


ITU 

ITU 

ITU 

ITU 

ITU 

ITU 


CART 

CONSENSUAL MONITOR 
CONSENSUAL SEARCH 
NIPCIP 


SSN: 
Name : 





Number: 6 

Type: NIPCIP SUBJECT INTERVIEWED 


3 




K 


To: Counterterrorism From:- Tampa 

Re: 288-TP-C42877 , 10/18/2000' 



ITU: NIPCIP , 

Claimed’ By i 1 

SSN: | 

Name; 

I K 

Number: 1 

Type: NIPCIP INFORMANT/ AS SET .DEVELOPED 

ITU:- NIPCIP 

Claimed By a 1 

SSN:- 

Name : I 


b6 

b7C 

b7E 


.Number: 1 

Type :- NIPCIP COOPERATING 'WITNESS’ OPENED 
ITU: NIPCIP 

•Claimed By:. 1 

SSN: 

.Name: 



To: Counterterrorism From: Tampa 

Re: 288-TP-C42877 , 10/18/2000 


LEAD(s): 

Set Lead 1: (Adm) 

\ 

COUNTERTERRORISM 

\ 

AT WASHINGTON. DC 
For information. 


♦♦ 
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- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/27/2000 


Date Of ?irhh f 

Sfign-ri fv AEE5H5E Nwpher (SSAN) 


]social. 


Information bervices, 
Vista, 


b6 

b7C 


wait Disney wonu 

Florida, was interviewed at his place of 


Company, Lake Eueria 

employment. After being advised of the identity of the 
interviewing Agent and purpose of the interview he voluntarily 
provided the following information: 


^_stated that he 

r-nmnn f-ing pnvirnnmpnf. and that 


i_s_al 


al 


for the distributed 
so present, is the 


sated that the "Leave a Legacy" 
the EPCOT park, is supported by computers, 
several SILICON GRAPHICS INCORPORATED (SGI] 

IRIX operating system (OS) and a ,PC wir.lj the LINUX operating system 


may have been accessed illegally, 


A ttraction within 
stated that 
computers, with the 


explained that the LINUX 


computer was a "File Transfer Protocol" (FTP) server which Walt 
Disney World Company used to store "tif" files which are later 
transferred to KODAK COMPANY and their subcontractors in order to 
facilitate the making of plaques. The plaques are then returned fn 
WALT DISNEY WORLD and placed on walls within the EPCOT park. 


stated that EPCOT patrons pay WALT DISNEY WORLD for the service 


stated that there are four (4) 


director ies on the 
Jxplained 


LINUX FTP server which contained customer data. | 
that three (3) of the directories contain files which are encrypted 
utilizing triple Digital Encryption Standard (DES) and the fourth 
directory contained files which were saved in clear text. 


J 


sated that the clear text file cont 
adaresseb and phone numbers of EPCOT patrons 


names, 

explained that the "tif" files normally contained 
(300) to four hundred (400) individual 


f ains imanp fi, 

\ 

tHiee juunured 


was used to FTP the files to KODAK and other places. 


files and that a "cron job" 


b6 

b7C 


the FTP seYVSYJ 


sated that four entities were authorized to access 
KODAK, The Disney Internet Group (DIG) , Feathering, 


a mail order company and the Disney Marketing Group. 


I 


investigation on 09/22/2000 >< Lake Buena Vista, Florida 


File # 28a ^-‘T*P-K1 Qri 
by SA 





Date dictated 09/27/2000 


This document contains neither recommeMattons nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents arc not to be distributed outside your agency. 


.. * 
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FD-302* (Rev. 1CMS-9J) 


288A-TP- 51940 


Cotttinuatioa ofFD-302 of 


■ On 09/22/2000 ,P»gc -2- 


down and 


stated that Wednesday afternoon the network slowed 
large amounts of data were flowing and that is when 


technicians grew concerned. 


| |explained that a Firewall had been removed from the 

Internet connection several months earlier for an unknown reason 
and that the removal of the firewall left the FTP Server and 
associated network segment, which was connected to the Internet, 
unprotected. 


stated that also connected to that segment of the 
network Was a computer which contained executable computer code 
which is used to control rides within the parks at WALT DISNEY 


WORLD. 


state that, although remote, it is possible that the 


executraDie could have been accessed. 


b6 

b7C 


technical 


[stated that his staff would provide additional 
Js and cooperate fully. 
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Fax Transmission 


Office of the I.ppfll Attache. 


To: 


GRI 


Date: October 26, 2000 


Fax#: 


Pages: 3, including this cover sheet. 


Voice #: 
From: 

Subject: 


Assistant Legal 

Attache 

Computer Intrusion - Walt Disney World Info System (our file # 288A-TP-51940) 


Comments: 


b6 

b7C 

b7E 


Gentlemen, 


Colleagues in our Tampa, Florida office, are investigating an appare nt computer intrusion 


into thft data systems at Walt Disney World in Orlando, Florida. The hacked 


|to perpetrate the crime. As is always the case, preservation of 

the user connection records, maintained by the IP, is vital to the successful investigation and 
prosecution of this matter. 


b7E 


Enclosed are two “Evidence Preservation” letters which are addressed to the IP in 
question. The letters list the specific times and log references which the investigators are 
interested in. Please provide the letters to the IP as soon as possible before the vital information 
is erased. 


The Tampa colleagues are also highly interested in obtaining subscriber information 
regarding the Internet accounts listed on the enclosed letters. Please advise if this is possible 
and/or if more detailed information is needed before the subscriber identification can be provided. 

Thanks for the assistance. 
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INDEXED 

serialized_4^^ 

FILED. 


-TV 5 -5/ 7^0 -7© 




ALL IMfOHMATIOM CGETTMN1D 

HEREIN IS UNCLASSIFIED 

DATE Qg-ls-2014 BY F4€M82JC40 NSICG 



U.S. Department of Justice 


Federal Bureau of Investigation 


* in Reply, picas* Refer to 500 East Zack Street 

File No. 


October 12, *2000 


Re:- Internet connection logs. 


b6 

b7C 

b7E 


Dear 


r 


You are respectfully notified to preserve all records, 
logs,, documentation flftd Qthey evidence for the Internet service 

connection | 

the period ot I 


J 


as \noted .above pursuant to iTitle 18 United' States Code 
Section 2703 (f ) for an initial period of ninety (90) days. 

You are further requested not to disclose the existence 
of or 'compliance with this notification. Any such disclosure 
could- seriously impair an on-going investigation into violations 
of United States Federal Criminal Law. 


If you have any qu estions regardi ng 


please contact Special ‘Agent 


at 


this notification 


b6 
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•Sincerely, 


Francis A- Gallagher 
Special Agent In Charge 


JBiti 

Supervisory Special Agent 





ALL IMfORMfeTIQN CXMTAIN1D 
HEREIN IS UNCLASSIFIED 
DATE 0S-15-2014 BY F4€MS2iC40 NSIOG 




x% 




^ito**************** DATE. CCT~26~20^^® <: *** TIME. 13*06. *** P.01 


STftRT-CCT-26 13 : 05 END*0CT-26 .13.: 06, 


mode;:- MEMORY TRANSMISSION 
PILE NOV- 092 

STN NO;. OOM ABBR NO. STATION NAMEVTEL.NO. PAGES DURATION 

001 OK <22> CRI 003/003 00: 00’ 51" 

-legat| 

************************************ I I ***** 


-«■; ********* 



Fax Transmission 

Office of the Legal Attache 


To: 

CRI 


Date:; October 26, 2000 


Fax#: Pages: 3. including this cover sheet. 

Voice#: 


From: 

Subject: 


[Assistant Legal 

Attache 

Computer Intrusion - Walt Disney World Info System (our file & 288A-TP-S1940) 


Comments: 


Gentlemen, 

Colleagues in our Tampa, Florida office, are investigating an appare nt computer intrusion 
into the data <v<rem<at Walt Disney World in Orlando, Florida. The hacker f I 


to perpetrate the crime. As is always the case, preservation of 
the user connection records, maintained by the IP, is vital to the successful investigation and 
prosecution of this matter; 


Enclosed are two “Evidence Preservation” letters which are addressed to the IP in 
question. The letters list the specific times and log references which the investigators are 
interested in. Please provide the letters to the IP as soon as possible before the vital information 
is erased. 


The Tampa colleagues are also highly interested in obtaining subscriber information 
regarding the Internet accounts listed on the enclosed letters. Please advise if this is possible 
and/or if more detailed information is needed before the subscriber identification can be provided.! 


Thanks for the assistance. 
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b7E 


Best Regards, 


b6 

b7C 



M,L IMfORmflCM CONTiMNEB 

HEREIN IS UNCLASSIFIED 

DATE 08-15-2014 BY F4€M82K40 NSICG 


Fax Transmission 

Office of the Leoal Attache 


Working Copy 


To; 



CRI 

Date: 

October 26, 2000 


Fax #; 
Voice #: 


Pages; 

3, Including this cover sheet. 



Subject; 

Computer Intrusion - Walt Disney World Info System (our file # 288A-TP-S1940) 


Case ID s 288A-TP-$1940 


Serial : 20 




— Working Copy 


r Comments: 

i 

i 

Gentlemen, 

Colleagues In our Tampa, Florida office, are Investigating an apparent computer Intrusion 


| |to perpetrate the crime. As is always the case, preservation of 

[ the user connection records, maintained by the IP, Is vital to the successful Investigation and 
prosecution of this matter. 

Enclosed are two "Evidence Preservation" letters which are addressed to the IP In 
question. The letters list the specific times and log references which the Investigators 
Interested In. Please provide the letters to the IP as soon as possible before the vital 
\ Is erased. 

The Tampa colleagues are also highly Interested In obtaining subscriber information 
regarding the Internet accounts listed on the enclosed letters. Please advise If this Is possible 
and/or If more detailed Information is needed before the subscriber Identification can be 
provided. 

Thanks for the assistance. 


are 

Information 


Into the data systems at Walt Disney World In Orlando, Florida. The hacker| 


8est Regards, 



all iMitffimTioM cm-TMimn 

HEREIN IS UNCLASSIFIED 

DATE 08-1 2014 BY F4 SMS2K40 NS ICG 


(01/26/199$) 


* 

FEDERAL BUREAU 


Precedence s PRIORITY 

To: Investigative Services 

Tampa 


INVESTIGATION 

Date: 11/07/2000 


Attn: 


From: 






* 


contact: ALAT 

r 

Approved By: 

Dratted By: 




Case ID # : 288A-TP-51940 (Pending) 

Title: UNSUB (S); 

WALT DISNEY WORLD - VICTIM; 

INTRUSION - INFO SYSTEM; 

Synopsis: Lead coverage, preservation of evidence letter 

delivered . 

Reference: 288A-TP-51940 Serial 10 

Details: As requested, the preservation of evidence letter 

I provided by Tampa was delivered to the custodian of records a t 

expressed tnerr cooperation witn tne request 


and stated the e vidence will be Preserved, if it s till exists. 
The attorney fo; 
order for Tampa 


The attorney for |advised that in 

to ontain private suoscriper xnrormation , an 


official legal request, in this case a Mutual Legal Assistance 
Treaty (MLAT) request, would be necessary. 

If Tampa determines a MLAT request will be sought , it 
is recommended the Assistant U.fi- At-ttorngv LA1L5A) in Tampa 

assigned this matter, contact | | of the Office of 

International Affairs (OI A) . Department of Justice (D OJ) , 




^_| is the 
and can lend 


Washington D.C., telephone 
attorney responsible for DOJ relations wit _ 
years of expertise in the formulation of a ‘mlat request directed 
to that country. 


. • *T - g/islol 
Tkstr v ^ i0 ~ 

p 

3/-vJAfA0/. GO 


considers Tampa serial 1 0. lead 1 as covered. 

N 

0 



b6 

b7C 

b7E 


be 

blC 

b7E 


mm o. 

SthlAlUEO 

ftlEO, 


-Tp- smo-^ 




Tos- 

Re:- 


I rive s t igativ^^S e rvice s From 
2 8 8 A - TP - 51940, 11/07/2000 


LEAD (s) : 

Set Lead 1: (Adm) 

. ALL RECEIVING OFFICES 

Please read and clea:r ACS. 


♦ ♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date:. 11/14/2000 

To: Counter Terrorism .Attn: CIU/CIOS/NtPC 

Room 11719 


From: Tampa; 


Approved By: 
Drafted By:' 
Case ID #: 



Title: . UNSUB (S) ; 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION - INFO SYSTEM; 

00: TP ‘ 


SUBMISSION: X Initial 


CASE OPENED: 09/26/2000 ' 


CASE CLOSED: Pending 


COORDINATION: Lega 


Legat 


Victim 


Company name; Walt Disney World Company 
Address/location: Lake Buena Vista, Florida 

Purpose of System: FTP Server 

Highest classification of information stored in system: Unclassified - Company Confidential / 
Patron Information. 


* 


b6 
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? 


A 


To: 
/Re : 




Counter-Terrorism, From: Tampa 

288A-TP-51940, ‘Date .11/14/2000 


System Data: 

Hardware/configuration (CPU); Dell OptiPlex - Intel Pentium 
Operating System.’ LINUX 6.0 - Default install - no patches 
Software;. 


Security Features: 

Security' Software Instal 
Logon (Warning Banner: 


led 

— 1 




INTRUSION INFORMATION 

rusion:. X Internet connecti 
If Internet; Internet address; 


ion J 


1-ViV.t 

none Host name: 


Method: 


Technique(s) used in intrusion! 


Path of intrusion: 

addresses? Unknown - although several external IP addresses were found in logs 
, and slack space and there is evidence that logs have been modified which indicates that the 
remaining IPs are not from the original compromise of the computer 
country: 

(facility: 

- Subject(s): Unknown 


Impact: 


Compromise of classified information:!^ 
Estimated number of compu ters affectedT 
^Estimated dollar loss to date! 


n. 


b7E 
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• • 

To: Counter Terrorism From: Tampa 

Re: 288A-TP-51940, Date 11/14/2000 


Category of Crime: 

Impairment: 

□ Attempted install- Malicious code 

□ Penial of service 

□ Destruction of information/software 
X Modification of information/soft ware 


Intrusion: 

X Unauthorized access 
□ Exceeding authorized access 


Theft of Information: 

□ Classified information compromised 
X Unclassified information compromised 

□ Passwords obtained 

□ Computer processing time obtained 

□ Telephone services obtained 

O Attempt to obtain Application software 

□ Operating software obtained 


REMARKS 


Walt Disney World Security, P.O. Box 


.10000, Lake Buena Vista, Florida, 32830, telephoned and reported 
that a computer system which contains patron personal information 
such as name, address, telephone number and photographs had been 
accessed by an unknown and unauthorized person or persons. 


been difir: 


stated that the victim server (computer) has 
:bnneccecr form the network and has not been modified, 
stated that Disney IS personnel are awaiting 
instructions from the FBI. 


In a subsequent interview . , 

] stated that the "Leave a 


Legacy" at p-a^t ii^n within the EPCOT park, is supported by 
computers 


tta 

ra 


stated that several SILICON GRAPHICS 
INCORPORATED (SGI) computers, with the IRIX operating system (OS) 
and a PC w ith the LINUX operating system may have been accessed 


illegally. | (explained that the LINUX computer was a "File 

Transfer Protocol" (FTP) server which Walt Disney World Company 
used to store "tif" files which are later transferred to KODAK 
COMPANY, and their subcontractors, in order to facilitate the 
making of plaques which are then returned to WALT DISNEY WORLD 


and placed on walls within the EPCOT park 




stated that 


EPCOT patrons pay WALT DISNEY WORLD for the service 


LINUX FTP' 
that three 


1 


stated that there are four (4) directo ries on the 
which contained customer data. I 


serve 

(3) of the directories contain files' wmcn 


explained 

are 


encrypted utilizing triple Digital Encryption Standard (DES) and 


b6 

b7C 
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To: Counter Terrorism From: Tampa 

Re: 288A-TP-51940, Date 11/14/2000 


the fourth directory contained files which were saved in clear 
text. Subsequent investigation revealed that Pretty Good Privacy 
(PGP) was used to encrypt three of the four tif file directories. 


I stated that the clear text files con tain Im ages, 

names, addresses and phone numbers of ■EPCOT patrons, 
explained that the "tif" files normally contained three hundred 
(300) to four hundred (400) individual files and that a "cron 
job" was used to FTP the files to KODAK and other places. 


| | stated that four entities were authorized to 

access the FTP server; KODAK, The Disney Internet Group (DIG) , 
Feathering, a mail order company and the Disney Marketing Group. 


stated that Wednesday afternoon the network 
slowed down ana a large volume of network traffic was noted and 
that is when technicians grew concerned and contacted management, 


b6 

b7C 


explained that their investigation revealed that 
a Firewall naa seen removed from the Internet connection several 
months earlier for an unknown 'reason and that the 'removal of the 
firewall -left the FTP Server and associated network segment 
connected to the Internet unprotected. 


stated that also connected to the affected 
segment of the network was a computer which contained executable 
computer code whi ch is us ed to control rides within the parks at 


WALT DISNEY WORLD .| | state that, although remote, it is 

possible that the executable ride control files could have been 
accessed. 


technical 


; 


stated that his staff would provide additional 
details and cooperate fully. 


Further investigation revealed that a 

installed and, at a minimum, the following processes were 
trojani zecU 


was 


b7E 


and a additional files were installed 
with suberdinahfi_di rectories of 
Also, a 




receptively. 

command was executed by victim personnel prior 
to the investigating Agent 1 s arrival and the output was directed 
to a txt file. By comparison of start times and dates, the ps 
command output indicate ^, although pos sibly unreliable due to 
modifications, that the 


was restarted on September 
12, 2000 at 23:06, the iaiue uaue uuu Approximate time stamps of 


4 
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il: 

FEDERAL BUREAU OF INVESTIGATION 


Date of tr inscription . 11/27/2000 

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 

Investigating, Agent 


t-ViroA f V nartpg vb'^Wrai Wvo-r^gg rvrvnl l 
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pursuant to a Grand Jury suppoena dated 


Investigition on 11/21/2000 »* Tampa, Florida 

File# 2S8A-TP-S194C 



by S A 




pate dictated 11-/27/2000 


b6 

hlC 


This document contains neither rcconmaendatTom tsw conclusions of the FBI. It is the property of the FBI and is loaned to your agency, 
it and its contents are not to be distributed outside your agency. 
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AO IIP (Rtv. 12/89) Subpo ana to Ttstify Before Grand Jury 


i States district (ttourt 


2000R02543 ARytT 

GJ NO. 00-1 C*'*'’'’ 

SUBPOENA NO: 1 'MIDDLE 


_ DISTRICT OF — — 
ORLANDO DIVISION 


FLORIDA 


SUBPOENA TO TESTIFY 

BEFORE GRAND JURY 

SUBPOENA FOR: 

i Epperson - 0 document^) or objects) 

YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District Court at 
the place, date, and time specified below. 



YOU ARE ALSO COMMANDED to bring with you the following documentls) or object(s):* 



Please provide documents to: 

Special Agen fj 

Federal Bureau of In vestigation 
500 East Zack Street 

Tamoa/FL 33602 I 1 

Fa / 1 

Vo/ce j 

O Pleasa sea additional information on revarsa 

» 

This subpoena shall remain in effect untH you are granted leave to depart by the court or by an officer acting pn 
behalf of the court. 


lYlT. 





sl/tf 


October 27, 2000 I 

LA r/L- 



' / 


Thi^ubpoena is issued-on application 
of the United States of America 

DONNA A. BUCELLA* 
United Statsc Attorney 


’I not appbcabi*, “no 


NAML ADDRESS ANC 


JM&ER Of ASSISTANT U.S. ATTORNEY . 


80 North Hughey Avenue; Suite 201 
Orlando, Florida 32801 407/648-7500 







AO 110<Rev, 12/89) Subpoena to Testify Before Grand Jury 




RETURN OF SERVICE «> 

RECEIVED 
BY SERVER 

DATE 


CE 

1 




SERVED 

0 




EE 

1 

-* Via ( i~cr~ 

SERVEO ON (PRINT N 

— 



i 


TRAVEL 

SERVICES 

TOTAL 

DECLARATION OF SERVERS | 


SERVED 81 
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I declare under penalty of perjury under the laws of the United States of America that the foregoing 


information c ontained in the Retur n of Servi, 


Executed on. 




ees is true and correct. 


£. 'Zxcx , -22b2i£&-, 

Address of Server 


ADDITIONAL INFORMATION 


(X) As to wno may serve a subpoena and the manner of Its service see Rule 17(d), Federal Rules of Criminal Procedure, or Rule 45(c), Federal Rules of Civil 

(2) “Fees and mileage need not be tendered to the witness upon service of a subpoena Issued on behalf of the United States or an officer or agency thereof 
(Rule 45(c), Federal Rules of Civil Procedures Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain Indigent parties and criminal 
defendants who are unable to pay such costs (28 USC 1825, Rule 17(b) Federal Rules of Criminal Procedure)*, 
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ALL 1 1-TT DKL* T IGH EDHTAIMEE 

HEREIN IS UNCLASSIFIED 

DATE 08-19-2014 BY F46MS2K40 NS ICG 


- I - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 01/22/2001 


Date of 3Ri rfch 

Security Account Nump er (SSAN) 


-Social. 


company, LaJ-ce Buena 
his place of employment by case Agent SA 


Information Services, Walt Disney World 
Vista, Florida, was contacted tejenhonically at 


COMPANY, 


was advised that his company, WALT DISNEY WORLD 
is cne' victi m of a computer crime and that the case Agent 


has evidence of such. 


was the obligation of the case Agent to provide 
company notification. 


|was further advised that a s a victim it 

and his 


Case Agent advised 
had been modified and that a 

Case Agent advised 


that-_logs on the victim computer 
was found. 


that no additional details could 


be provided at this time and that the investigation was ongoing. 


investigation on 1/22/2001 >t Tampa , Florida 
File # 288A-TP-51940 



( telephonical lv) 


Date dictated 1/22/2001 


This document contains neii 
it and its contents axe not to be distributEToutside your agency. 


iclusions of the FBI, It is the property of the FBI and is loaned to your agency; 
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ALL INJFQRM&T I QM COFTAIW1B 

herein is unclassified 

DATS Q8“13““2Q14 BY F4€MB2K40 NS IDG 
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FEDERAL BUREAU OF INVESTIGATION 


Precedences ROUTINE Date: 02/02/2001 

To i Tampa 


From: Tapaaa 


rtrsn 


Contact: SA 




Approved By: 
Drafted By: 


Case ID #: 288A-TP-51940 


Title: UNSUB (S): , 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION - INFO SYSTEM 


b6 

b7C 


Synopsis: Investigative accomplishments report regarding 

captioned matter. 

Details: Interviews with captioned victims conducted. 

I b3 
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To: Tampa FromzWxampa 

Re:? 2 8 8A-TP- 51 94 0 , 02/02/2001 


Accomplishment Information: 


Number i 1 

Type : 'NlPCIP VICTIM .CONTACTED/ INTERVIEWED 

ITU': NlPCIP 

Claimed By: 


Name : 






Number: 1 

Type: NlPCIP COMPROMISED SITE IDENTIFIED AND NOTIFIED 

ITU: NlPCIP C ■ 

Claimed Byn ■ 


SSN: 

Namft 


j: 


♦♦ 


y l 
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ALL INFORMATION CQNTMN1I} 

HEBE IN IS UNCLASS IEIED : 

DATE 08-13-2014 BY F46M82N4D NSICG 


Automated Serial Permanent Charge -Out 
FD-5a (1-5-94) 

Date: 06/06/01 Time: 12:18 


Case ID:- 288A-TP-51 940 Serial: 31 
Description of Document : 


Type : LETTER 

Date : : ns/is/ni 

To : 

.'From : US ATTORNEY 


ESQ 


Topic: REQUEST RETURN OF SIGNED PLEA AGREEMENT 


b6 

b7C 


Reason for Permanent Charge-Out:; 

WRONG. FILE NUMBER WRITTEN BY CASE AGENT 
Transferred to: 

Case ID: 288A-TP-51201 Serial:- 77 
Employee: 








> . 

JFD-542 (Rev. 1102- 1599) 


ALL INFORMAT I QH CONTAINED 
^HEREIN IS OTIC LAS 3 I FIED 
DATE 0S-1S-2014 BY F4SM82K40 NSICGl 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/14/2001 

To : Tampa 

From: Tartuaa 

Contact: SA 

Approved By: 

Drafted By: 

Case ID #: 288A-TP-51940 (Pending) 

Title: UNSUB (S) ; 

WALT DISNEY WORLD COMPANY - VICTIM; 

INTRUSION - INFO SYSTEM 

Synopsis: 2703(d) Court Order obtained and served regarding 

captioned matter. 

Details: A Court Order pursuant to Title 18 U.S.C. Section 




1 


J 4 4 OTHER Sealed Per Court Order 
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To:- Tampa Prom:- ^rempa 
Re: 288A-TP-51940 , 03/14/2001 


Accomplishment Information: 

Number:- 1 

Type:- Nl'PCIP 2703(d) ORDER SERVED' 
ITU: NlPCIP 

Claimed By? . 

SSN: L I . 

. Name : \ 



[ftLL INFOKM&.TICM CCffiTTaiNlD 
HEBE IN IS UNCU&S S lEIED 
DATE 08-13-2014 BY F4€M82If40 NSICG 

FU-542 (Rev. 11-02-1999) 




FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 03/15/2001 


To : Tampa 

From: Ta mpa ^ 

Contact: SA 

Approved By: 

Drafted By: 

Case ID #: 288A-TP-51940 


b6 

b7C 

b7E 


Title: UNSUB (S); 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION - INFO SYSTEM 


Synopsis: 2703(d) Court Order obtained. 

Details: A Court Order pursuant to Title 18 U.S.C. Section 







OTHER Sealed Per Court Order 


2703(d) Court Order served statistic has been claimed in 
FD-542 , 288A-TP-51940 , Serial 34. 




! ' 


j- i 



2^A-' ^-51^^0-35 



To: 
Re : 


Tampa From:- ^cimpa 
288A-TP-51940, 03/15/2001 


Accomplishment Information: 


Number:- 1 

Type:- NIPCIP 2703(d) ORDER OBTAINED 
ITU: NIPCIP 


raea ay. 
SSN : 
Name: 
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ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 08-19-2014 BY F4€MS2K40 NSICG 

FD-302 (Rev. 10^95) 




ih 

FEDERAL BUREAU OF INVESTIGATION 


Date of tr tsscrip&n 03/22/2001 


i 


b6 

b7C 


issued pursuant to Title 18 U.S.C 
in his letter that 


voluntarily provided the enclosed 
in response to a. 

Section 2703 (d) . I 


one (1) page letter. The letter is in response to a , rnnrf Or der 

states 


requested via the Court Order. other sealed Per court order 

The letter ;is provided to the file this day. 


\ 




n 


„ \ i 

in 4 
a n * t- 

* i L . • 
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Investigation on 3/22/2001 »t . Tampa, Florida > 



Tbis document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is loaned to your agency; 
it and its contents are not to he distributed outside your agency. ! * » 
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ALL IMfORM&TIGM CONrTifLINED 
HSBEIM IS UNCLASSIFIED^ 

DATE 08-19-2014 BY F46M82K40 NSICG 





Automated Serial Permanent Charge-Out 
FD-5a. (1-5-94) 

Date: 09/05/01 Time: 08:23 


Case ID:- 288A-TP-51 940 Serial: 37 


Description of Document: 


Type : 

■ Date. : 
To : 
From : 
Topic :- 


INSERT 
04/18/01 
TAMPA 
TAMPA- 


Reason for Permanent Charge-Out:; 


AGENT REQUESTED TO DELETE AND SERIALIZE CORRECTED COPY. 
.Employee:; 
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ALL I.L1 F OELLAT I Gl-1 COW T All-ISC 

HIRE III IS DNClaAS S IFIED 

DATE QS-19-2014 BY F46M82K40 WSICG 





288A-TP-51940 
RVH : rvh £jL^ 


1 


On this date, April 18, 2001, Special Agent 
Iforwarded a draft of a r equest for assistance from the 

pursuant to a- Mutua l Assistance 
Treaty to Assistant unites States Attorney (AUSA) F 
is to review the document and forwarded it, ' 


corrections, to the Department of Justice, 
final approval and. forwarding. 


ana any 
Washington, D.C. 


for 
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ALL IMimmTIOM CXMTAINED 

HEREIN IS UNCLASSIFIED 

DATE 08-l§-2014 BY F4€M82K40 NSICG 

(Rev, OS-2 $-2000) 




FEDERAL BUREAU OF INVESTIGATION 


Precedence s ROUTINE 


Date* 12/10/2002 


To* Tampa 
From* Tamna_ 


Cyb er Crimes 
SA 


Contact* 

Approved By* 

Drafted By* 

Case ID #* 288A-TP-51940 (Pending) 


Title* UNSUB (S); 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION - INFO SYSTEM 


Synopsis* EC to file documenting telephonic contact with AUSA 

regarding a pending Mutual Legal Assistance Treaty 

imlat) request. 


Details* Per telephonic contact with AUSA 


e 


,T request re ga rdin g c aptioned matter 


December 10, 2002 , the M: 

remains pending with the 

confirmed the matter remains pending via the Office of 
International Affairs (OIA) , USDOJ, Washington, D.C. 


on 
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♦♦ 





ALL INFORMATION CX3NTAIN1D 

HEREIN IS UNCLASS IFIHD 

DATE 08-13-2014 BY F4€l£82K40 NSIC# 

JFD-302 (Rev. 1 0-6-9 J) 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 05/20/2003 


Special Agent 


received' the attached 1 


three ill naae document trom Assistant united. States Attorney 


on the afternoon, of May 20, 2003. The document is a 
'ggpTy"'T.fl a for Hat-.a via t-.hs Mutual Assistance Treaty 


b6 

b7C 

b7E 


(MLAT) frod 


The reply, -from 


is. dated March 27, 


2003 and the accompanying cover sheet is dated May 19, 2003 

Subject document is entered into the file this date. 


investigation on . 5/20/2003 *« Tampa , Florida 

File M 288A-TP"51940 
by SA[ 




Date dictated N/A 
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This document contains neither yecomme ndaA^, u.i ill usions of the FBI It is the property of the FBI and is loaned to your agency; 
it and its contents arc not to be distributed outside your agency. 
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U.S. Department of justice 

Criminal Division 


Washing*®, D-C. 20530 


TELEFAX transmittal sheet 


DATE: May 19, ,2003 


TO: | | 

Assistant United States Attorney 
Middle District of Florida 
U.S. Att orney's Office 
Telefax: I I 


FROM: 


SUBJECT: 

REFERENCE: 


Mary Ellen Warlow 
Director 

OFFICE OF INTERNATIONAL AFFAIRS 
CRIMINAL DIVISION 



For:- 


Senior Trial Attorney 
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MESSAGE: 


Please see t he attached copy of a fax from 

regarding the execution of this request. 


Number of pages: 
Telephone number: 
Telefax number: 
E-mail address : 


i 

s 


Sf>nt- hv- iT M~B 




I 




all iMimmTioM om-TMimn 

HEREIN IS UNCLASSIFIED 

DATE 0S-1S-2014 BY F4€MS2N40 NS 


FD-$0 1 (Rev, 7* \ 5-97) 


FEDERAL BUREAU OF INVESTIGATION 


^Precedence: > ROUTINE Date: 05/20/2003 

To: Cyber Attn: CCIU 

Room 5965, SSA 

From: Tampa 

Approved By: 

Drafted By 


b6 

b7C 


Case ID #: 288A-TP-51940 

Title: UNSUB(S); 

WALT DISNEY WORLD - VICTIM; 
INTRUSION -- INFO SYSTEM; 


SUBMISSION: Final; 


CASE OPENED: 09/29/2000 


• CASE CLOSED: 05/21/2003 


I 

COORDINATION: Lega 


4 


Victim 


MEAT request which produced no evidence. 


b7E 


. Company name: Walt Disney World Company 
Address/location: Lake Buena Vista, Florida 


Purpose of System: FTP server 

‘Highest classification of information stored in system: Unclassified 
System Data: 

Hardware/configuration (CPU): Intel 
Operating System: Red Hat 6.0 
Software: 

Security Features: 

Security Software Instal led] 

Logon Warning Banner: | 

INTRUSION INFORMATION 

Access for intrusion: X Internet (TCP/IP) 



2 — TP' S/9Y& 

L 1 _ 




To : Cyb e r From : ^rampa 

Res 288A-TP-51940, Date 05/20/2003 


/ 

Method: Technique(s) used in intrusion: believed to bef 


Subject 1: UNSUB(S); 


Impact: _ 

Compromise of classified information: I 
Estimated number of computers affec ted 
Dollar loss to date: 



* * 


To: Cyber From: ^Tampa 

Re: 288A-TP-51940, Date 05/20/2003 



Category of Crime: 

Impairment: 

O Attempted install- Malicious code 
O Denial of service 

□ Destruction of information/software 

□ Modification of information/software 


Theft of Information: 

□ Classified information compromised 
X Unclassified information compromised 

□ Passwords obtained 

□ Computer processing time obtained 

□ Telephone services obtained 

□ Attempt to obtain Application software 


Intrusion: 

X Unauthorized access 


REMARKS 


Per MLAT response received from the 
dated March 23, 2003 and- received by the U.S. Attorney's Office, 

Middle District of Florida, on May 19, 2003 no information was 

available regarding subject IP address 


date. 


No further logical leads to pursue. 

Writer recommends captioned matter be closed this 


b7E 


♦♦ 
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